Merge pull request 'fix: set TTS bridge secret ownership' (#22) from fix/tts-secret-owner-20260813130906 into main

app.py

@@ -1905,14 +1905,21 @@ async def tts_bridge_deploy(req: TTSBridgeDeployRequest, _=Depends(_verify)):
         "/app-config/tts-bridge/butler-token": BUTLER_TOKEN,
         "/app-config/tts-bridge/client-token": client_token,
     }
-    encoded = base64.b64encode(json.dumps(files).encode()).decode()
-    script = (
-        "import base64,json,os,pathlib;"
-        f"files=json.loads(base64.b64decode('{encoded}'));"
-        "pathlib.Path('/app-config/tts-bridge').mkdir(parents=True,exist_ok=True);"
-        "[(pathlib.Path(p).write_text(v),os.chmod(p,0o600)) for p,v in files.items()]"
-    )
-    rc, _out, err = _ssh("sascha@10.5.85.5", f"sudo python3 -c {__import__('shlex').quote(script)}", timeout=30)
+    installer = """import json, os, pathlib
+files = json.loads({files_json!r})
+base = pathlib.Path('/app-config/tts-bridge')
+base.mkdir(parents=True, exist_ok=True)
+for filename, value in files.items():
+    path = pathlib.Path(filename)
+    if path.is_dir():
+        path.rmdir()
+    path.write_text(value)
+    os.chown(path, 10001, 10001)
+    os.chmod(path, 0o400)
+""".format(files_json=json.dumps(files))
+    encoded = base64.b64encode(installer.encode()).decode()
+    command = f"sudo python3 -c {__import__('shlex').quote(f'import base64;exec(base64.b64decode({encoded!r}))')}"
+    rc, _out, err = _ssh("sascha@10.5.85.5", command, timeout=30)
     if rc != 0:
         _audit("/tts/bridge/deploy", "POST", 500, "secret installation failed")
         raise HTTPException(status_code=500, detail="Could not install bridge secrets")